package app

import (
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/url"
	"strings"
)

type oidcDiscovery struct {
	Issuer   string `json:"issuer"`
	UserInfo string `json:"userinfo_endpoint"`
	TokenURL string `json:"token_endpoint"`
	AuthURL  string `json:"authorization_endpoint"`
}

func (a *App) fetchOIDCDiscovery() (oidcDiscovery, error) {
	if strings.TrimSpace(a.cfg.OIDCIssuerURL) == "" {
		return oidcDiscovery{}, errors.New("OIDC_ISSUER_URL is required")
	}
	u := a.cfg.OIDCIssuerURL + "/.well-known/openid-configuration"
	resp, err := http.Get(u)
	if err != nil {
		return oidcDiscovery{}, err
	}
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	if resp.StatusCode >= 300 {
		return oidcDiscovery{}, fmt.Errorf("oidc discovery failed status=%d body=%s", resp.StatusCode, strings.TrimSpace(string(body)))
	}
	var d oidcDiscovery
	if err := json.Unmarshal(body, &d); err != nil {
		return oidcDiscovery{}, err
	}
	if strings.TrimSpace(d.UserInfo) == "" {
		return oidcDiscovery{}, errors.New("oidc discovery missing userinfo_endpoint")
	}
	return d, nil
}

func (a *App) validateBearerToken(token string) (User, error) {
	d, err := a.fetchOIDCDiscovery()
	if err != nil {
		return User{}, err
	}
	req, err := http.NewRequest(http.MethodGet, d.UserInfo, nil)
	if err != nil {
		return User{}, err
	}
	req.Header.Set("Authorization", "Bearer "+token)
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return User{}, err
	}
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	if resp.StatusCode >= 300 {
		return User{}, fmt.Errorf("oidc userinfo failed status=%d body=%s", resp.StatusCode, strings.TrimSpace(string(body)))
	}
	var claims map[string]any
	if err := json.Unmarshal(body, &claims); err != nil {
		return User{}, err
	}
	if aud := strings.TrimSpace(a.cfg.OIDCAudience); aud != "" {
		if !claimContainsAudience(claims["aud"], aud) {
			return User{}, errors.New("token audience does not match configured OIDC_AUDIENCE")
		}
	}
	username := firstStringClaim(claims, "preferred_username", "username", "sub")
	if strings.TrimSpace(username) == "" {
		return User{}, errors.New("oidc token missing preferred_username/username/sub")
	}
	email := firstStringClaim(claims, "email")
	return User{Username: username, Email: email}, nil
}

func claimContainsAudience(v any, expected string) bool {
	switch t := v.(type) {
	case string:
		return strings.EqualFold(strings.TrimSpace(t), expected)
	case []any:
		for _, item := range t {
			if s, ok := item.(string); ok && strings.EqualFold(strings.TrimSpace(s), expected) {
				return true
			}
		}
	}
	return false
}

func firstStringClaim(claims map[string]any, keys ...string) string {
	for _, k := range keys {
		if v, ok := claims[k]; ok {
			if s, ok := v.(string); ok && strings.TrimSpace(s) != "" {
				return strings.TrimSpace(s)
			}
		}
	}
	return ""
}

func postForm(urlStr string, values url.Values) ([]byte, int, error) {
	req, err := http.NewRequest(http.MethodPost, urlStr, strings.NewReader(values.Encode()))
	if err != nil {
		return nil, 0, err
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		return nil, 0, err
	}
	defer resp.Body.Close()
	body, _ := io.ReadAll(resp.Body)
	return body, resp.StatusCode, nil
}